Vulnerabilities > Apple > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2016-09-25 | CVE-2016-4611 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple Iphone OS, Safari and Tvos WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4730, CVE-2016-4733, CVE-2016-4734, and CVE-2016-4735. | 6.8 |
| 2016-09-18 | CVE-2016-4747 | Information Exposure vulnerability in Apple Iphone OS Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors. | 4.3 |
| 2016-09-18 | CVE-2016-4746 | Information Exposure vulnerability in Apple Iphone OS The Keyboards component in Apple iOS before 10 does not properly use a cache for auto-correct suggestions, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging an unintended correction. | 5.0 |
| 2016-09-18 | CVE-2016-4741 | 7PK - Security Features vulnerability in Apple Iphone OS The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an HTTPS session for retrieving updates. | 4.3 |
| 2016-09-18 | CVE-2016-4719 | Information Exposure vulnerability in Apple Iphone OS and Watchos The GeoServices component in Apple iOS before 10 and watchOS before 3 does not properly restrict access to PlaceData information, which allows attackers to discover physical locations via a crafted application. | 4.3 |
| 2016-09-18 | CVE-2016-4620 | Information Exposure vulnerability in Apple Iphone OS The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app. | 4.3 |
| 2016-09-16 | CVE-2016-6936 | Information Exposure vulnerability in Adobe AIR SDK & Compiler 22.0.0.153 Adobe AIR SDK & Compiler before 23.0.0.257 on Windows does not support Android runtime-analytics transport security, which might allow remote attackers to obtain sensitive information by leveraging access to a network over which analytics data is sent. | 5.0 |
| 2016-09-12 | CVE-2016-4852 | Improper Input Validation vulnerability in Aki-Null Yorufukurou YoruFukurou (NightOwl) before 2.85 relies on support for emoji skin-tone modifiers even though this support is missing from the CoreText CTFramesetter API on OS X 10.9, which allows remote attackers to cause a denial of service (application crash) via a crafted emoji character sequence. | 4.3 |
| 2016-09-06 | CVE-2016-7153 | Information Exposure vulnerability in multiple products The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack. | 5.0 |
| 2016-09-06 | CVE-2016-7152 | Information Exposure vulnerability in multiple products The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack. | 5.0 |